Dev.to Security πŸ” Cybersecurity πŸ‘ 0 πŸ“– 1 min read

Five Public Checks That Separate Real Telegram Channels from Bot-Farmed Junk

Telegram channels are the highest-noise public OSINT source I work with. Not because the content is bad - because the channel names lie. A channel called "Ukraine War News πŸ‡ΊπŸ‡¦πŸ‡·πŸ‡Ί" is 40% repost spam, 30% opinion, and 30% s

Telegram channels are the highest-noise public OSINT source I work with. Not because the content is bad - because the channel names lie. A channel called "Ukraine War News πŸ‡ΊπŸ‡¦πŸ‡·πŸ‡Ί" is 40% repost spam, 30% opinion, and 30% signal, and the signal is buried under engagement-bait formatting.

After running automated collection over dozens of channels, these are the checks that actually separate keepers from junk.

1. The view/subscriber ratio test. Public channel previews at t.me/s/<name> expose per-post view counts for channels over ~1000 subscribers. A channel with 12k subscribers averaging 300 views has a dead or inflated audience. Ratio under 5% = suspicious, under 2% = bought.

2. The timestamp clustering test. Real audiences post comments and forwards across a spread of hours. Bot-boosted channels show engagement concentrated in tight windows. The post preview timestamps are public; cluster them.

3. The repost laundering test. Junk channels survive by reposting each other in rings. Track which channels appear as t.me/<other>/postid links inside a channel's posts. A dense mutual-repost graph = ring, not reach.

4. The wording-diff test (the one that pays). Don't archive posts; diff them. When a ministry's advisory wording shifts from "avoid travel" to "avoid all travel" - that single delta is the intelligence event. My alerts fire on fuzzy-match failures against the previous version, not on new posts. This cut my review load by ~80% and made me earlier than raw feeds.

5. The language coverage test. For Ukraine warzone monitoring, English-only collection is systematically late - strikes, drone warnings, and rear-area events surface in Russian-language channels first. Filter by language, not geography.

The remaining six rules (admin provenance, engagement farming, content-farm fingerprints, and friends) plus the scoring sheet are in my Telegram & Web OSINT Bundle, $5. A free sample brief showing the exact output format: here.

All collection runs free on GitHub Actions - no server, no paid APIs.

πŸ“° Read the original article on Dev.to Security

Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes β€” full credit and traffic to the original publisher.